Cisco ISE dot1x printers

[Amr Moussa]

I am converting now our ISE from using MAB to use dot1x and I am trying now on my lab with HP4015 printer, the printer is dot1x supported and I enabled PEAP and EAP-TLS on it, and installed the CA certificate also but I am facing the below error:

12503 Failed to negotiate EAP because EAP-TLS not enabled in Allowed Protocols.

all protocols are allowed in the allowed protocol but I don't know why I am seeing this error.

[ahollifield]

Is the printer 802.1X matching the correct policy set?  

It is also not best practice to allow all of those authentication protocols.  You should only allow those protocols that you NEED.

[dal]

When going into live logs, what Policy Authentication does the printer hit?

And have you connected the correct Allowed Protocols set (the page you had a picture of) to that Policy Set?

[Amr Moussa · Accepted solution]

I have managed to solve the printers issue after adding the Root CA certifacte , but now I have a problem with my Windows 10 PCs:

R0/0: sessmgrd: Authentication failed for client (a44c.c89f.1fe6) with reason (No Response from Client) on Interface Gi1/0/3 AuditSessionID A0028F0A00000FEF8D476C1C
Jun 23 07:29:50.135: %SESSION_MGR-5-FAIL: Switch 1 R0/0: sessmgrd: Authorization failed or unapplied for client (Mac Address) on Interface GigabitEthernet1/0/3 AuditSessionID A0028F0A00000FEF8D476C1C. Failure reason: Authc fail. Authc failure reason: No Response from Client.

[ahollifield]

Is Wired AutoConfig Service enabled on Windows?  Is the supplicant actually configured?

[Amr Moussa · Accepted solution]

Dears,

I managed to solve the problem after installing the adding new certificate from our CA.